VDB
Sign up
HIGH7.5

GHSA-wjfq-88q2-r34j

Unhandled exception when decoding form response JSON

Quick fix

GHSA-wjfq-88q2-r34j — pocketmine/pocketmine-mp: upgrade to the fixed version with the command below.

composer require pocketmine/pocketmine-mp:^4.0.7

Details

### Impact When handling form responses from the client (`ModalFormResponsePacket`), the Minecraft Windows client may send weird JSON that `json_decode()` can't understand. A workaround for this is implemented in `InGamePacketHandler::stupid_json_decode()`.

An `InvalidArgumentException` is thrown by this function when it fails to fix an error found in the JSON, which is not caught by the caller. This leads to a server crash.

### Patches 56fe71d939c38fe14e18a31a673a9331bcc0e4ca

### Workarounds A plugin may handle `DataPacketReceiveEvent`, capture `ModalFormResponsePacket` and run the provided JSON through `stupid_json_decode`.

Note that this requires copying the body of the function to a plugin, since the function is currently private.

### For more information If you have any questions or comments about this advisory: * Email us at [team@pmmp.io](mailto:team@pmmp.io)

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/pocketmine/pocketmine-mp
Introduced in: 4.0.0Fixed in: 4.0.7
Fixcomposer require pocketmine/pocketmine-mp:^4.0.7

References